I know someone who is adamant that they can create a risk score combining user risk/operational risk/and downtime risk. They've been saying it for around 4 years now and i have yet to see this magic logic. By their way of thinking an Anaesthetic machine is a high risk device, my input that only a few selected trained operators of the machine make it less risky is not up for discussion......... As Geoff writes, get exactly what is wanted/needed before beginning.